Active defense method of network system based on vulnerability correlation analysis

Abstract

The purpose of the invention is to provide an active defense method of a network system based on vulnerability correlation analysis. The method comprises the following steps: step 1, constructing a vulnerability database, and collecting vulnerability records; step 2, describing related concepts of network attack; step 3, mining an attack path; step 4, determining a risk grade of each host in the network system; step 5, determining an optimal attack path; and step 6, calculating a vulnerability restoration emergency level. Compared with the existing methods, the active defense method of the network system based on the vulnerability correlation analysis has the following advantages: (1) the attack path mining algorithm well combines the vulnerability correlation researches based on privilege improvement; and (2) a dynamic calculation method of the vulnerability restoration emergency level is provided, and a network administrator can be guided to reasonably arrange the vulnerability restoration sequence, and the purpose of active defense is realized.

Description

technical field [0001] The invention relates to a network system active defense method based on vulnerability correlation, which belongs to the technical field of information security. Background technique [0002] The biggest threat to the network system is computer security loopholes. Security loopholes will exist in all aspects of software and hardware, including system design and implementation, operation management, improper user operations or system failures. No network system can completely eliminate loopholes. Therefore, research on vulnerabilities should not only focus on the characteristics of known vulnerabilities, but also pay attention to the correlation between vulnerabilities. Practice has shown that there are often connections between vulnerabilities. Isolated vulnerabilities may not bring fatal blows to the system, but if network hackers use their connections with each other to launch secondary or even multi-level attacks, it will bring serious damage to the...

AI Technical Summary

Problems solved by technology

In the process of generating the attack graph, the change of the attacker's own authority due to the exploitation of a certain vulnerability should be reflected in the attack path. As the premise of changing privileges, there are problems such as excessive system space consumption and network explosion; in the research of attribute-based attack graph generation, there are also problems such as the need to manually mark the relationship before and after the vulnerability or the inaccurate classification results of the vulnerability, which makes the algorithm The implementation is more complex or the generated results are inaccurate, which limits the practicability of various attack graph generation tools

Images